Privacy notice
This notice explains what personal data AfroMarket uses when you browse, contact us, create an account or place an order. It is information about processing, not a request to accept unnecessary processing.
Effective date:
Who is responsible for your data?
The controller for the AfroMarket online store is:
AfroMarket d.o.o. Novi SadRumenka, Vojvode Putnika 10, Srbija
afromarket.rs@gmail.com
+381 62 960 46 45
What we use and why
We use only the data needed for the purposes below. Where a statutory retention period applies, transaction records are retained but their use is restricted to that purpose.
| Activity | Data and purpose | Legal basis | Retention |
|---|---|---|---|
| Browse and secure the site | Session identifier, IP address, browser/device data and security events, used to operate the cart, prevent abuse and diagnose faults. | Service necessity and our legitimate interest in a secure, reliable shop. | Session data expires when the session ends. Routine security and diagnostic logs are normally kept for up to 30 days; relevant incident records may be kept longer. |
| Account and social sign-in | Name, email, telephone, password hash, preferences and registration IP. When you approve a trusted device we also store its IP and browser signature. Social sign-in adds the provider and stable identifier returned by Google or Meta; OAuth access tokens are not retained. | Steps requested before a contract and performance of the account service. Security is our legitimate interest. | While the account is active, then deleted or anonymised following a valid request except where a legal retention duty applies. Registration IP is anonymised within 30 days, trusted-device authorisation expires after 90 days, and the social link is removed with the account. |
| Orders and delivery | Contact and delivery details, cart, order history, chosen delivery method and order comments, used to fulfil and support the order. To protect checkout we also record the ordering IP, browser user agent and accepted language. | Contract, steps requested before a contract, legal duties relating to commerce, tax and accounting, and our legitimate interest in preventing fraud. | Operational data is kept only while needed. Core transaction and accounting records may be retained for the applicable statutory period, no longer than 10 years where such a period applies. Order fraud metadata is anonymised within 12 months unless it is linked to an active security incident, fraud review or legal claim. |
| Payments and refunds | Order number, amount, payment status/reference and contact details sent to the selected payment provider. AfroMarket does not receive or store your full card number or card security code. | Contract, accounting/legal duties, and our legitimate interest in preventing payment fraud and resolving disputes. | Payment and transaction evidence is retained for the statutory accounting, refund, chargeback and claims periods, with access restricted. |
| Customer support | Name, contact details, message and any order details you provide, used to answer and document the request. | Contract where the request concerns an order; otherwise our legitimate interest in providing support. | Normally up to 24 months after the request is closed, or longer only when needed for an active dispute or legal duty. |
| Public reviews and article comments | The author name, review, comment or reply text, rating and publication date are shown publicly. We use the account identifier for product-review moderation. Article comments and ratings also record the submission IP to prevent abuse. | Publication at your request and our legitimate interest in operating trustworthy community features and preventing abuse. | Published author, text and rating data is deleted after a verified erasure request. Article-comment and article-rating submission IPs are deleted or anonymised within 30 days. Content may also be removed earlier through moderation. |
| Affiliate programme and payouts | Company and website, tax details, payment method and, depending on your choice, payee, PayPal or bank-account details, commission and payout history. Data is shared only as needed with the selected bank or payment service, accountants and authorised AfroMarket staff. | Steps requested before an affiliate contract, performance of that contract, accounting and tax duties, and our legitimate interest in preventing payout fraud and reconciling payments. | The active affiliate profile is kept while the programme relationship continues. It is then deleted or anonymised, while the minimum commission and payout ledger may be retained with restricted use for the applicable statutory accounting and claims periods. |
| Store credit and rewards | Store-credit funding and balance allocations, reward points and their application to orders, used to keep balances accurate, prevent duplicate use and reconcile refunds. | Contract, applicable accounting duties, and our legitimate interest in maintaining an accurate credit and reward ledger. | Non-essential account display data is removed with the account. Where law or an unresolved claim requires it, the minimum store-credit and reward ledger is retained with restricted use for the applicable accounting and claims periods. |
| Product requests, ratings and stock alerts | Account or temporary browser identifier, selected product, request or rating, date, and email when you ask for a stock alert. | The service you request, our legitimate interest in improving the catalogue, and consent for an email stock alert. | A stock-alert email address is deleted after the alert is sent or withdrawn; unresolved alerts expire after 12 months. Guest product requests and ratings expire after 12 months. Account-linked choices remain while the account is active and are removed with it. |
| Newsletter | Email address and evidence of the subscription choice, used only to send the newsletter. | Consent. Subscription is optional and can be withdrawn at any time. | Until you unsubscribe or a verified account erasure is completed. While the account remains, its choice history contains no email or IP address. No separate newsletter-consent evidence is retained after account erasure. |
| Optional analytics and marketing attribution | Search terms, campaign parameters, referrer and interaction data used to understand campaigns and improve the catalogue. | Consent where required. Optional collection is off until you choose it. | Identifiable first-party optional analytics records are kept for no more than 30 days, then deleted or aggregated. If an optional provider integration is enabled after consent, its browser-cookie durations are listed separately in the Cookie Policy. |
Who receives data?
Access is limited to people and providers who need the data for the stated purpose. Depending on your choices, these include:
- AfroMarket staff responsible for sales, customer support, accounting and security;
- delivery providers, including D Express, for the delivery you select;
- Alta Bank / the hosted payment processor for card payments, refunds and fraud checks;
- banks, payment services and accounting advisers where needed for affiliate payouts and reconciliation;
- Google or Meta only when you choose the corresponding social sign-in;
- Cloudflare for anti-bot and security checks on protected forms;
- hosting, email, maintenance and professional advisers under appropriate confidentiality and data-protection terms;
- public authorities where disclosure is required by law.
Some technology providers may process data outside Serbia or the country where you are located. Before such processing is enabled, AfroMarket assesses the provider and uses the transfer and contractual safeguards required for the relevant service. You may request information about the safeguards that apply to your data.
What is required?
Fields marked as required are needed to create the requested account, deliver an order or answer the form. Without them we may be unable to provide that service. Newsletter and optional analytics choices are never required to buy from us.
AfroMarket does not make decisions that produce legal or similarly significant effects using solely automated profiling.
Your choices and rights
Subject to the conditions and exceptions in applicable law, you may:
- ask for a copy of your personal data and information about its use;
- correct inaccurate or incomplete data;
- ask for deletion or restriction of processing;
- object to processing based on legitimate interests;
- receive data you supplied in a portable format where the right applies;
- withdraw consent at any time, without affecting earlier lawful processing.
Use the privacy request form or email afromarket.rs@gmail.com. We will verify your identity and respond within the period required by applicable law.
You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection at poverenik.rs. Where the GDPR applies, you may also complain to the supervisory authority in the EU/EEA country of your habitual residence, your place of work, or the place of the alleged infringement.
How we protect data
- Encrypted HTTPS connections and secure session controls;
- role-based administrative access and password hashing;
- minimisation of data sent to payment and social-login providers;
- logging, backups and access review appropriate to the service risk;
- incident assessment and notification where required by law.
After deletion, data may remain temporarily in protected rotating backups until it is overwritten under our controlled backup cycle. It is not returned to active use and, if a backup is restored, the deletion is applied again. Contact us for the current backup-rotation period.
Cookies and similar storage
Necessary storage keeps the cart, security and language working. Optional categories remain off until selected. See the Cookie Policy to review or change your choice.
Changes to this notice
Material changes will be published here with a new effective date. If a change requires a new consent, we will ask for it separately.